> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Anonymized Data Export

> How telemetry is anonymized for Hilt model improvement while preserving privacy.

## Purpose

Hilt's detection models improve when trained on diverse, real-world behavioral patterns. Anonymized data export is a core part of every Hilt deployment: a structured pipeline produces anonymized statistical summaries on a daily schedule, helping calibrate detection thresholds across different infrastructure types.

***

## Dashboard view

**Settings → System** provides an export management panel:

* **Export picker** — a dropdown to select an export by ID. Each export shows an icon indicating its status (approved or pending).
* **Manifest panel** — once an export is selected, a detail panel displays:
  * Date range
  * Row count
  * Host count
  * Temporal jitter applied
  * File size
  * SHA-256 hash
  * Column list
  * Excluded columns note
  * Zero-filled columns
  * Status badges (anonymized, approved, transferred to Hilt)
* **Approve export** — a button to approve the selected export, with a confirmation dialog.
* **Delete (reject)** — a button to delete and reject the export, with a confirmation dialog.
* **Sample table** — a preview showing the first 20 rows of the export data.

When no exports exist, an empty state reads: *"Exports run on a daily schedule"*.

**Permissions**: viewing exports requires the **`view_audit`** permission; approving or deleting exports requires the **`manage_users`** permission.

***

## What is exported

| Data category | Description | Why it's safe |
| :- | :- | :- |
| **Aggregate numeric features** | Counts per 5-minute epoch (e.g., execution count, bytes transferred, unique destinations) | No raw values, only aggregate statistics |
| **Derived statistical features** | Ratios, entropies, and mathematical transforms of the aggregate counts | Pure algebra on aggregates |
| **Abstracted activity tokens** | Closed-vocabulary activity type sequences (no filenames, IPs, or commands) | All identifying information already removed at tokenization |
| **Anomaly labels** | Binary anomaly flags and scoring-phase labels | No customer-specific context |
| **Temporal keys** | 5-minute bucket timestamps (jittered ±0–48h) | Calendar correlation prevented |

***

## What is never exported

| Data | Why |
| :- | :- |
| File paths, command lines, arguments | Direct infrastructure/PII leakage |
| IP addresses, hostnames, DNS names | Network topology exposure |
| Usernames, SSH identities, Okta data | Identity leakage |
| Cloud resource IDs (instance, IAM role, region) | Account fingerprinting |
| Container/pod names and namespaces | Kubernetes topology |
| Detection rule names and match logic | Customer security posture |
| Free-text alert explanations | May echo sensitive event context |
| Dashboard accounts and sessions | Access credential exposure |

***

## Anonymization

Before export, all identifying information is stripped or remapped:

* **Host IDs** → deterministic sequential remap (`host-0001`, `host-0002`, …)
* **User IDs** → sequential integers per host
* **Owner/identity strings** → dropped entirely
* **Timestamps** → shifted by a random 0–48h offset to prevent calendar correlation
* **Minimum host threshold** → exports with fewer than 5 hosts are rejected

***

## Customer controls

### Review before transfer

When approval is required (the default), the export produces a manifest and a small sample file. The full archive is staged but **not transferred** until you explicitly approve. You can:

* Inspect the manifest to verify exactly which columns are included
* Load the sample file to confirm anonymization
* Reject by deleting the staged files from your storage bucket

### Date range control

You control how much history to export and can limit to specific time windows.

### Deletion

You can delete exported data from your storage bucket at any time.

### Audit trail

Every export creates a logged event with the export ID, row count, date range, and approval status. The host ID mapping file stays exclusively in your bucket.

***

## Operations reference

### What Hilt receives

Behavioral feature vectors and abstracted activity sequences only. No filenames, IP addresses, hostnames, usernames, cloud resource IDs, detection rule names, or match descriptions.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.